Elcomsoft Phone Viewer
The tool allows investigating digital evidence collected in local and cloud iOS device backups, iCloud synchronized data and file system images. Elcomsoft Phone Viewer enables investigating existing and deleted records including call logs, address books and messages within minutes. Additionally, the application can export collected records into Microsoft Excel. Moreover, the application provides quick access to crucial location data by analyzing media files with EXIF tags and mapping them on OpenStreetMap.
The program can also analyze iCloud backups and iTunes file system images to obtain vital information about the suspect’s activity. For example, it can retrieve and display Restrictions passwords as well as Screen Time passwords while analyzing iOS locally-backed up backups. In addition, it can directly examine encrypted offline backups produced by Apple iTunes without requiring the use of other tools to pre-decrypt them.
Furthermore, Elcomsoft Phone Viewer can retrieve and display deleted SMS and iMessage messages saved in iOS backups. In addition, it can display pictures and videos captured with the phone as well as downloaded as messages or attachments. It can automatically split images into several categories – separating pictures from video recordings, system and app images such as buttons, logos and splash screens. Moreover, the program can automatically filter out and sort pictures by location to obtain their GPS coordinates.
In the past, the only way to acquire physical evidence from an iPhone was through manual analysis with a dedicated tool or a full-fledged forensic suite that requires considerable expert knowledge and significant time investment. With the introduction of iOS 6 and later, Apple devices are powered by 64-bit processors that enable full physical acquisition via file system imaging.